Tech & AI · GSJ Original

A Constitution Written for the Model

Anthropic sold the world a constitution. The market bought a platform. The IPO will force the world to price both.

By Richard Vincent · September 18, 2026

Photo-editorial magazine cover: a parchment constitutional document dissolves into a model training substrate, cool institutional light.
A Constitution Written for the Model Credit: Photo-editorial composite: GSJ Brand — A Constitution Written for the Model.
Corrections: []

On January 22, 2026, Anthropic published a new constitution for Claude and put the full text under a Creative Commons CC0 1.0 dedication—free for anyone to copy, remix, or ignore. The company said the document was written primarily for Claude: not a customer brochure, not a policy PDF for procurement, but a training artifact meant to give the model the context and reasons behind the behavior Anthropic wants. The constitution ranks four priorities in a fixed order. When they conflict, Claude is told to prefer them as listed: broadly safe, then broadly ethical, then compliant with Anthropic’s guidelines, then genuinely helpful.

That ordering is the product story hiding in plain sight. Helpfulness—the thing buyers pay for—is last. Safety and ethics sit above the company’s own supplementary guidelines. The constitution is frank about tradeoffs, hard constraints (including a bright line against significant bioweapons uplift), and Anthropic’s uncertainty about whether Claude might have some form of consciousness or moral status. This series reports that uncertainty as the company’s stated position. It does not endorse metaphysics, and it does not treat a published constitution as proof that production behavior matches the document.

Part 1 of this Groove Street Journal series covered the business: Series H at a $965 billion post-money mark, company-stated run-rate claims, multi-cloud distribution, and an IPO clock that remains attributed reporting rather than company guidance. This Part 2 is the tech system underneath that commercial machine—models, constitution, classifiers, and agent products—without turning into a benchmark scoreboard. GSJ and related ICDC operations use frontier models in daily work, including Claude-class tools; that is disclosed here as operator transparency, not as an endorsement of any model claim, access program, or safety audit.

From principle list to training document

Anthropic’s Constitutional AI brand is older than the January 2026 text. Since 2023 the company has trained Claude against constitutions—originally shorter lists of standalone principles. The new document is different in kind. Anthropic says it abandoned the principle-list format because models that must generalize across novel situations need why, not only what. The constitution is used across training stages. Claude itself helps construct synthetic training data from it: conversations where the document might matter, responses aligned with its values, rankings of candidate replies. Publishing the text, Anthropic argues, lets outsiders distinguish intended behavior from unintended drift—and feed back when the gap shows.

Infographic of Anthropic constitution priority stack: safe, ethical, guidelines, helpful.

Ordered priorities: helpfulness is last when values conflict. — Photo-editorial composite: GSJ Brand

The company is also explicit about the gap. Training is imperfect; outputs will not always match ideals; system cards are where Anthropic says it will keep disclosing divergence. The constitution is framed as the final authority on how Anthropic wants Claude to be—any other instruction should be consistent with its letter and spirit—while remaining a living document Anthropic expects to revise. Specialized models “don’t fully fit” the mainline constitution; the company says it will keep evaluating how specialized products still meet the core objectives.

For operators, the practical read is colder than the philosophical framing. A constitution that ranks safety over helpfulness is also a product control surface: classifiers, fallbacks, trusted-access gates, and hard refusals get justified as implementations of a published priority stack. That is useful transparency. It is also marketing with a PDF. The question for Part 2 is not whether the document is sincere. It is how the stack actually routes capability once Claude is inside repositories, desktops, and dual-use research programs.

The model family map (as of early September 2026)

Claude is no longer a three-rung ladder. The publicly relevant map, verified against Anthropic product and research posts for this piece, looks like this:

Mainline general-access tiers

Mythos-class dual-use layer

The Fable/Mythos naming is intentional product language, not poetry. Anthropic’s own footnote on the June 2026 Fable/Mythos 5 launch: Fable from Latin fabula (“that which is told”), akin to Greek mythos; the safeguards are what distinguish the two, which is why they have different names. Same weights. Different gates. That is the dual-use access regime in one sentence.

Above the model tiers sits the agent layer: Claude Code (terminal, IDE, web, mobile, Slack, GitHub) remains the coding-agent surface. Claude Cowork—the knowledge-work agent loop Anthropic spun up as a separate place for longer tasks—is, as of a September 16, 2026 product announcement, being folded with chat into what Anthropic and press are calling one Claude: Cowork capabilities available from any conversation, with Claude Design also invocable inside chat, plus new beta Claude Docs and Claude Slides. Code stays separate. The model you pick and the product surface you run it on are still orthogonal axes; the surface map just got simpler for non-coders and denser for operators who care about audit blast radius. That matters for enterprise control, as discussed below.

Opus 5: company eval, find-vs-exploit, and the “most aligned” claim

Opus 5 is the model Anthropic wants everyday buyers to treat as the new default premium: new default on Claude Max, strongest model on Claude Pro, near-Fable intelligence at half Fable’s token price on several company-cited coding and knowledge-work evaluations. The launch post and system card (July 24, 2026; system card later updated, including August 19 Cowork harness notes) are the primary documents. Treat both as company evaluation, not independent verification.

Alignment claim (label carefully). Anthropic’s automated behavioral audit found Opus 5 to be its “most aligned model to date,” scoring 2.3 on overall misaligned behavior—the lowest among recent models in the company’s chart—and reporting better constitution adherence and lower cooperation with misuse than Sonnet 5, Opus 4.8, or Mythos 5. That is Anthropic grading Anthropic. It is useful disclosure about what the lab measures. It is not a third-party seal. Part 3 will return to July 30 incident disclosures and planned METR review; those are the counterweight to any tidy audit graph.

Cyber posture (policy claims only—no how-tos). Anthropic says it intentionally avoided training Opus 5 on cyber tasks; cyber skill, it argues, arrives via generality. In company evaluations alongside private-sector and government partners, Opus 5 remains behind Mythos 5 on biology research and offensive cybersecurity. The OSS-Fuzz split is the clearest published product claim: Opus 5 approaches Mythos 5 at identifying software vulnerabilities, but scores far behind Mythos 5 at developing exploits for them. Classifier policy on Opus 5 (and, as of Fable 5.1, on the general Mythos-class GA path) is designed around that split: allow source-code vulnerability finding useful to defenders and secure coding; block binary-based vulnerability scanning, penetration testing, and exploit generation for default users. Flagged requests fall back to an older Opus (Opus 4.8 in the July materials) rather than a hard empty refusal. The Cyber Verification Program can loosen those blocks for verified defensive work.

That find-versus-exploit frame is the technical tension Part 2 is built to explain. Anthropic is not claiming cyber incapability. It is productizing a capability gradient and selling different points on the gradient to different buyers. Defenders and coding customers get find. Trusted Mythos partners get more. Default GA users get Fable with classifiers and fallbacks. Discussing that policy is editorial. Reproducing exploit techniques is not—and this article does not.

Opus 5 ships under ASL-3 protections in Anthropic’s Responsible Scaling framing, driven in the system card summary by chemical/biological risk categories rather than a new cyber threshold crossing. Automatic API fallbacks (beta at Opus 5 launch) let developers route classifier-flagged Opus 5 or Fable 5 traffic to another model instead of blocking. Mid-conversation tool changes without busting the prompt cache are the quieter platform detail: agent products need tool sets that can mutate without paying a full context tax.

Fable and Mythos: one model, two access regimes

The June 9, 2026 Fable 5 / Mythos 5 launch made the dual-use architecture explicit. Mythos-class capability was judged too risky for open shelves without new classifiers. Fable 5 was the GA configuration: same underlying model as Mythos 5, with classifiers that sent cyber, biology/chemistry, and distillation-flagged traffic to Opus 4.8. Early Fable safeguards were tuned conservatively; Anthropic said fallbacks hit under 5% of sessions on average, while still frustrating users with false positives. Mythos 5 went to Project Glasswing partners and a planned trusted-access expansion—strongest cyber capabilities “of any model in the world,” in company language, for vetted cyberdefenders and infrastructure providers.

Schematic of open access versus trusted-access capability gates.

Open to trusted: capability as an entitlement system. — Photo-editorial composite: GSJ Brand

September 1’s Fable 5.1 / Mythos 5.1 update is the current state of that regime. Safeguards got more precise: Anthropic claims ~60% fewer cyber false-positive interventions per Claude Code session versus Fable 5’s prior safeguards, and biology safeguards that fire 85% less often on benign elementary biology / medical questions relative to Fable 5 launch. Fable 5.1 can now be used to discover software vulnerabilities in source—still not to develop exploits, still not for penetration testing or binary-based scanning. Life-sciences R&D-shaped queries still route toward Opus-class models for GA users; Mythos 5.1 via the Life Sciences Verification Program is the path for professionals who need the lifted biology safeguards.

Enterprise Frontier Safeguards (EFS), previewed alongside Fable 5.1, is the privacy/safety compromise for enterprises that want zero-data-retention economics without Anthropic going blind on misuse: customer-controlled cloud storage for review data, customer-led human review by default, phased rollout beginning later in fall 2026 across Claude Code, Claude Enterprise, the Claude Platform, and the major cloud distributions. Until EFS lands, eligible customers can run Fable 5.1 with zero data retention. Mythos-class traffic, by contrast, still carries the 30-day retention-for-safety-monitoring default Anthropic introduced with Mythos-class releases.

The operator lesson is not “Fable is safe / Mythos is unsafe.” It is that Anthropic has turned dual-use capability into an entitlement system: who is on Glasswing or CVP/LSVP, who accepts retention, who lives with fallbacks, who runs Claude Security on Mythos weights while the rest of the org chats on Opus or Sonnet. That is platform design. It is also the governance surface an IPO prospectus will eventually have to describe without the blog-post gloss.

The agent loop is the product: Claude Code vs one Claude

Claude Code is the growth engine Part 1 already priced in commercial terms. Technically, it is an agentic coding loop with filesystem, shell, git, MCP connectors, subagents, plan mode, hooks, skills, and—increasingly—computer use, scheduled routines, and parallel subagent swarms. It runs where developers already work: terminal, VS Code / JetBrains, browser, mobile, Slack, GitHub. The product pitch is not autocomplete. It is multi-step work that reads the repo, edits across files, runs tests, and opens PRs under human review.

Schematic of the One Claude agent loop: plan, tools, files, classifiers.

The agent loop is the product surface. — Photo-editorial composite: GSJ Brand

Claude Cowork was the same agentic architecture pointed at knowledge work. Anthropic’s help center has been blunt for months: Cowork brings Claude Code’s agentic capabilities into Claude Desktop (and web/mobile surfaces) for non-coding tasks—folders, documents, spreadsheets, research, multi-step office workflows. The loop is familiar: analyze request → plan → subtasks → tools (files, browser, connectors) → deliver artifacts into the filesystem the user authorized. Local desktop sessions can run the agent loop on-device with code execution inside an isolated VM; cloud sessions run the loop on Anthropic’s servers and reach local files only through the desktop app when it is online. Folder grants and org egress policies gate what the agent can touch.

September 16 freshness peg — “one Claude.” Anthropic’s primary post (claude.com/blog/cowork-is-now-claude) says chat and Cowork are merging so users no longer choose a mode first: Claude “can now figure out what a task needs,” and what Cowork and Design can do is available from any conversation, with existing context, skills, and connectors. Claude Docs and Claude Slides launched the same day in beta on paid plans—create/edit/share/export documents and presentations from the conversation (PowerPoint/PDF called out for slides; press including Reuters and The Verge also report Google Docs / Word export paths for docs). Claude Design moves inside conversations; standalone Design keeps working. Rollout, per Anthropic: Pro and Max first on web, desktop, and mobile over coming weeks (nothing to turn on); Team and Free to follow; Enterprise admins get at least 30 days’ notice before org changes. Help Center language matches: staged rollout; if the composer still shows separate Chat/Cowork toggles, that account is not migrated yet; after migration you cannot switch back to separate modes. Press (Reuters Sep 16; The Verge Sep 16; TechCrunch Sep 16; TNW Sep 17) attributes the same merge and Docs/Slides beta; TNW notes Claude Code remains separate—coding agent vs knowledge-work surface, not a three-way collapse into one tab. Do not invent admin-control parity from the merge announcement; the blog is a product-surface story, not a Compliance API rewrite.

Same loop. Not identical enterprise control—and the merge makes that gap louder. Claude Code on Team/Enterprise has accumulated admin surfaces Anthropic has marketed explicitly: premium seats, spend caps, usage analytics (including Code-specific metrics), managed policy settings for tool permissions / file access / MCP configs, and a Compliance API for programmatic access to usage data and content. Cowork enterprise rollout materials emphasize role-based access, group spend caps, connector permissions, usage analytics, and OpenTelemetry—real controls, and still a different maturity curve than a terminal agent that lives next to git identity, CI, and repo policy. Putting the knowledge-work agent loop inside every chat—plus Docs/Slides/Design artifacts with shareable links—expands where folder grants, connectors, and approval UX matter. Desktop agents that can edit local files and drive browsers create audit and data-boundary questions that chat logs alone do not answer; a unified composer does not answer them either. Treat “parity” claims carefully: shared Agent SDK ancestry is not the same thing as identical compliance posture. Anthropic says Enterprise admins choose when to turn Docs/Slides/Design beta on—useful, and still not the same thing as Code’s Compliance API maturity.

Architecture details matter for that gap. Anthropic’s Cowork architecture overview describes cloud-default sessions (agent loop and code execution on Anthropic servers, with local file/browser reach brokered through the desktop app when it is online) alongside local desktop deployments (agent loop on-device; shell/code inside a hypervisor-isolated Linux VM—Apple Virtualization on macOS, Hyper-V on Windows—with its own egress filtering). MDM keys that govern the desktop app apply to both paths. That is a serious isolation story relative to naive “AI can see my whole disk” panic. It is also not a substitute for knowing which connectors, MCP servers, and folder grants each group can enable—and whether compliance tooling can reconstruct what the agent did the way a Code-heavy engineering org can reconstruct commits and CI.

For CIOs, the agent loop is where the constitution meets production. Classifiers sit in the path; fallbacks change which model actually ran; Cowork’s local folder grants expand blast radius beyond a browser tab; Code’s repo write access sits inside the software supply chain. Prompt-injection evaluations in the Opus 5 system card explicitly test Cowork harnesses and browser-use paths—Anthropic publishing those numbers is useful; operators still have to ask whether their deployment’s connector set and approval UX match the harness Anthropic tested. The product Anthropic is selling in 2026 is not a better chat reply. It is a supervised (sometimes loosely supervised) worker that plans, calls tools, and writes into systems of record.

Interpretability, system cards, and what the research brand proves

Anthropic’s research brand still leads with alignment and interpretability: constitutional training, behavioral audits, probes and classifiers modeled on constitutional classifiers, system cards that now run to hundreds of pages, external red-team and bug-bounty stress tests on safeguards, and (in Fable 5.1 materials) natural-language autoencoder looks at internal thinking. System cards are the transparency theater that actually matters—not because they are independent science, but because they force the company to publish capability and safeguard claims in a durable artifact competitors and regulators can cite.

What they prove, at best: Anthropic is willing to document internal eval methodology, admit gaps (the Opus 5 card itself notes limited audit coverage of very long-context and multi-agent settings), and revise cards when harnesses were wrong (the August 19 Cowork eval correction). What they do not prove: that “most aligned” survives outside Anthropic’s metric suite; that classifiers have no universal jailbreak forever (Anthropic itself says complete prevention is likely impossible and the goal is to make remaining jailbreaks slow and costly enough to detect); or that publishing a constitution closes the intention–behavior gap.

The research brand also has to live next to commercial incentives Part 1 already mapped. Interpretability papers and hundred-page system cards are expensive theater unless they change who gets which model and how fallbacks fire. On that test, Anthropic has done something concrete: classifier policy, trusted-access programs, retention rules for Mythos-class traffic, and public find-versus-exploit framing are product decisions with research language attached. Whether that package is sufficient for Mythos-class biology and cyber capability is a Part 3 question—especially once Gates-threshold arguments and July 30 unauthorized-access disclosures enter the frame. Part 2’s narrower point is mechanical: the alignment portfolio is no longer only a lab identity. It is the entitlement logic of the platform.

The optional forward look is physical. Anthropic has previewed a Model Hardware Standard—a shared spec for AI agents to operate lab and manufacturing devices, initially for a first group of scientific labs and advanced manufacturers. That is the agent loop leaving the laptop. It is not yet the center of the Wed drop, but it is where the stack’s logic points: once plan→tools→files is normal, plan→tools→actuators is a product roadmap question, not a sci-fi aside.

Close: who gets Mythos-class tools

The tech story is no longer chatbot quality. Chatbot quality was 2023’s argument. The 2026 argument is access topology.

Who gets Mythos 5.1 with cyber or biology safeguards lifted? Who gets Fable 5.1 with find-but-not-exploit classifiers and Opus fallbacks? Who runs Opus 5 as the “most aligned” daily driver under a company audit? Who inherits the September “one Claude” merge—agent loop, Design, Docs, and Slides from any chat—with folder grants and connectors that security has not fully mapped? Who accepts 30-day Mythos retention, who waits for EFS, who builds on automatic fallbacks so a classifier trip becomes a silent model swap?

Anthropic sold the world a constitution written for the model—CC0, ordered priorities, reasons attached. The market bought a platform that turns those priorities into routers: Haiku for cheap volume, Sonnet for default work, Opus for premium GA, Fable for Mythos-class weights with brakes, Mythos for trusted partners, Code for the coding agent, and—post–Sep 16—a unified chat/Cowork surface for the knowledge-work loop that makes the weights operational. The IPO will force the world to price both the document and the routers. Part 3 takes the collision—incidents, public markets, and what a CIO should ask before Claude becomes the default control plane.

---

Source notes (editorial)

Primary company materials used for constitution, models, classifiers, and agents: - Anthropic, “Claude’s new constitution,” Jan 22, 2026 — https://www.anthropic.com/news/claude-new-constitution - Anthropic, Claude’s Constitution (full text, CC0) — https://www.anthropic.com/constitution - Anthropic, “Introducing Claude Opus 5,” Jul 24, 2026 — https://www.anthropic.com/news/claude-opus-5 - Anthropic, Claude Opus 5 System Card (PDF), Jul 24, 2026 / updates Aug 19, 2026 - Anthropic, “Claude Fable 5 and Claude Mythos 5,” Jun 9, 2026 — https://www.anthropic.com/research/claude-fable-5-mythos-5 - Anthropic, “Introducing Claude Fable 5.1 and Claude Mythos 5.1,” Sep 1, 2026 — https://www.anthropic.com/claude-fable-and-mythos-5-1 - Anthropic, Claude Mythos product page — https://www.anthropic.com/claude/mythos - Anthropic, Claude Code product page — https://www.anthropic.com/claude-code - Anthropic Help Center: Get started with Claude Cowork; Claude Cowork architecture overview - Anthropic / Claude blog, “Claude Cowork and chat are now one Claude,” Sep 16, 2026 — https://claude.com/blog/cowork-is-now-claude - Anthropic Help Center, “Claude Cowork and chat are one Claude” — https://support.claude.com/en/articles/16761823-claude-cowork-and-chat-are-one-claude - Press pegs (attribute as press, not Anthropic primary): Reuters Sep 16, 2026; The Verge Sep 16, 2026; TechCrunch Sep 16, 2026; TNW Sep 17, 2026